662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991

Analysis

max time kernel
150s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
Size 73KB
Sample260509-e6qdlaax3y
SHA256 662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991
MD5 815a3dd62ea898f2d796f6969b73675b
SHA1 909b1a8c461519c023323b30f756eda1d44c7ba7
SHA512 945d275e64c9aaccaba892d44ea0db62b56d3730ff0354da31b7b32e51f0f1a526d14d07557d9de2992863de5c48044b255a3a4debf1a61ddb5cfcac640f7497
SSDEEP 1536:/fgLdQAQfcfymN3uuS2nnggOT/AH2pakpeOInUqUKSHaeK:/ftffjmN3uuLXUy2pJIOInUqU6F
TLSH
T196739E0A33D4C066F1220B34CDF5F76122BDBE619CA9961B76A8730E2EB1BC4E515327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3124	Logo1_.exe
784	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2020.503.58.0_neutral_split.scale-200_8wekyb3d8bbwe\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\merge-styles\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	Logo1_.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\WidevineCdm\_platform_specific\win_x64\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\zh-cn\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\wa\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Resources\sv-se\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\motion\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Windows NT\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\nb-no\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Icons\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\components\Breadcrumb\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\EBWebView\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	Logo1_.exe
File created	C:\Program Files\WindowsApps\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dtplugin\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\_desktop.ini	Logo1_.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-tw\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
File created	C:\Windows\Logo1_.exe	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\vDll.dll	Logo1_.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4812	784	WerFault.exe	86

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Logo1_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe
3124	Logo1_.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3804	1792	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe	80
PID 1792 wrote to memory of 3124	1792	662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe	81
PID 3124 wrote to memory of 2268	3124	Logo1_.exe	82
PID 2268 wrote to memory of 3504	2268	net.exe	85
PID 3804 wrote to memory of 784	3804	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
"C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E5E.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe
    "C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:784
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 784 -s 632
      4⤵
      Program crash
      PID:4812
- C:\Windows\Logo1_.exe
  C:\Windows\Logo1_.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 784 -ip 784
1⤵
PID:2544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdateBroker.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe
Size 125KB
SHA256 16e3d52e0e6ec0e6b7ac8d5604a0617c197efb5571486f3c70cbd393fd8f4ccd
MD5 9d109d27c56312da47576612cd2fdd33
SHA1 66ee25ce9ecec412e51ffafd9c4a8a93dae86efc
SHA512 f977b698ef015aa25139ece9e63a4484a9dfaabb0a3f58414af2ac3fdb7b2eb34f53d4c9f0777dc852b72c5764c3d332fdf5c0e2075e7c97c76004a5023de694
SSDEEP 3072:mftffjmNyYCkuRieOVETT+jYPnau3fVGAhoxqzB+3qGH4L:eVfjmNyYCk3ET+Tu3fCUzB+JHI
TLSH
T119C38D1375D08472E4B6593109A1EA718A3EFD620950DE6B33D41B3E0F316D1DE2AE6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ImportExit.exe

Path C:\Program Files\ImportExit.exe
Size 181KB
SHA256 cd4f71593e797f8bc72e0907d8bb907a4c41badab62ee9f84c560f23adba49f1
MD5 f89375ba5e40913e851b4849f7e215e2
SHA1 7fc527b45e75d5c3f1913dc44f73607bfdc3ba9a
SHA512 254c75416ababe894ad5012bc5476e13434fc30484b3a75f8c8413be6d944adc751a11c6e5667eca35fcb6ccddc549dc384881844a555e8db449a1a97f1610b6
SSDEEP 3072:/ftffjmN8oWXCr8v7xnnT5BEjFtvqhyXv28bkNKksY8mMuxeDt/lI8Qrci:nVfjmN8oWXEc7xnnTmtvtf2vKwtxeRX+
TLSH
T1E404126DAAC40231E9227CF8974271809F9FD9FE9DDE92F872D0B42413812B187DF965
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcredist_x86.exe

Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
Size 481KB
SHA256 d5fbaf5c0d8e313d4dad23b28cac4256c5dbed6ab3b0d797e2971f30c5e095ad
MD5 1db5b390daa2d070657fbdb4f5d2cc55
SHA1 77e633e49df484b827080753514cc376749b0ceb
SHA512 68aa0152f5aae79a146c1813915fd16ec5454b285bd1781370923f97d6c147d53684192f7f4161e5c1a340959ec432ecaac127b0abe7d08f70c387e08ee4f617
SSDEEP 12288:Pp7+ZqIOkU8AMXE9B7PElZlP41N+4PUWfo:R7ABOkUhMXcBwc04nA
TLSH
T116A46D31A6A04037D6F106B3F915D2307E7DA2187B1184AB9394AE2D3EA95D7A7F7303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

$$a2E5E.bat

Path C:\Users\Admin\AppData\Local\Temp\$$a2E5E.bat
Size 722B
SHA256 2ea11ce63515ba35a1b0197c97f33196b974369266f0d80882f685ea57cd1b6e
MD5 dce09e131627c83f657f272d9c7b2733
SHA1 13b96c532f1b64b40fe1c0b035f63df6bb6bd775
SHA512 685a1deb2e891bd8343e7739c7cf50c8bada6d9c73a3bab8ab459f37e1bb99cfd15859224a93602b05be515f03ce2edc7df0a4dce4a192e41a4e5a7118b48143
TLSH
T18601F193A48AE11F9E37D16BDE1145DFA0360C5EBE81373025E2F38A5180208E8F72D2
MD5 SHA1 SHA512 TLSH

Submit Download

662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe.exe

Path C:\Users\Admin\AppData\Local\Temp\662432c64a02aecd7a1294dd44ea11ba20cffa8a8b9f9185cff7f4bb0f540991.exe.exe
Size 47KB
SHA256 993d2b2fa72dadc7753c62b39d0d35ef1586f00f2eed60eb729057142ad76b4a
MD5 493b286f0c41fcc9a44cb2b6a94f6fef
SHA1 2e4a742f01acc2cee315e31a64b176d892ef0022
SHA512 9f74f38acdb47bc03642631252176f61464d9fbded6aa574af200ff5e436d7d56724548e27470413624842db11760464c376f19c76647388de7ead4c1c838167
SSDEEP 768:6euGX2eSP2UpKngb0l4vta6Tybq6LH21zaQVplk1OJRrInIfjqUKSL3baeK:DuuS2nnggOT/AH2pakpeOInUqUKSHaeK
TLSH
T1BE236E0A7795C066F2620B308DB8F66136BDBE619DA4970F769C730E1EB1BC4E520367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logo1_.exe

Path C:\Windows\Logo1_.exe
Size 26KB
SHA256 fb0131eab8d4465a6b25b029683e5b656e2dc64fada85c9b82f8a755dd2549e2
MD5 007c15ee810811c5a6aa7b2b97c031ef
SHA1 b56db442604ba4e202dae87b85954570f4410ee5
SHA512 5811cd20d11801116331db2dd80677f3c523dbd32139a8510a8bb02512ae61590781ee7444c928f1e0c713bba51a28b6dff61d4e23584275877c4387cbd7e566
SSDEEP 768:kf61ODKAaDMG8H92RwZNQSwcfymNBg+g61GoL:/fgLdQAQfcfymN
TLSH
T160C2E07A12C81574D826597DDFD36702833D0F7A049F59AA39F1B97F22707A9100EB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-3847269522-1618051987-1942096715-1000\_desktop.ini
Size 8B
SHA256 6e9be20748ee78b11d664f31b9547ee836b5e73f3d4ef05289327d7f1ba0eb14
MD5 40ceb2ed83210f4185f76feb1846e3d0
SHA1 e8b81c1d0babb9887ef3703b2804d6d1a2f31d63
SHA512 62538e5d4e898b44b402a6c1f2a32edd5945428b2891b38363935cf3d358a7638f88313b7be5209c29be487b899cca3ba7d53923a193cf06b722fec679357ef1
MD5 SHA1 SHA512

Submit Download

memory/784-20-0x0000000003120000-0x0000000003722000-memory.dmp

Download

memory/1792-0-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/1792-11-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-29-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-37-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-43-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-22-0x00000000021C0000-0x00000000021C7000-memory.dmp

Download

memory/3124-762-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-1234-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-5017-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-8-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3124-5516-0x0000000000400000-0x0000000000434000-memory.dmp

Download